DOD Financial Management: Ineffective Risk Management Could Impair Progress toward Audit-Ready Financial Statements

The National Defense Authorization Act (NDAA) of Fiscal Year 2010 mandated that DoD's consolidated financial statements be validated as audit ready by September 30, 2017. The NDAA for Fiscal Year 2012 further mandated that DoD's General Fund Statement of Budgetary Resources be audit ready by the end of fiscal year 2014. DoD issued the Financial Improvement and Audit Readiness (FIAR) Plan and related guidance to provide a strategy and methodology for achieving its audit readiness goals. However, substantial risks exist that may impede DoD's ability to implement the FIAR methodology and achieve audit readiness. GAO was asked to assess DoD's risk management process for implementing its FIAR Plan. This report addresses the extent to which DoD has established an effective process for identifying, analyzing, and mitigating risks that could impede its progress in achieving audit readiness. GAO interviewed DoD and component officials, reviewed relevant documentation, and compared DoD's risk management processes with guiding principles for risk management. In January 2012, DoD identified six department-wide risks to FIAR Plan implementation: lack of DoD-wide commitment, insufficient accountability, poorly defined scope and requirements, unqualified or inexperienced personnel, insufficient funding, and information system control weaknesses. GAO recommends that DoD design and implement policies and procedures for FIAR Plan risk management that fully incorporate the five risk management guiding principles and also consider the Navy's and DLA's risk management practices. While DoD did not fully concur, it cited planned actions that are consistent with GAO's recommendations and findings. These are good first steps, but GAO believes additional action is warranted. GAO affirms its recommendations. Report to Congressional Requesters.